Privacy Shield: Brace Yourself, Changes are Coming
Although adopted three months after the GDPR, the Privacy Shield (1), which is designed to regulate the flow of personal data between the European Union and the United States of America, has already come under scrutiny: it was first evaluated by the European Commission in October 2017 (2), then by the European Parliament (3) and recently by the Commissioner for Justice, Consumers and Gender Equality, Věra Jourová (4). Its future is uncertain and in the meantime, the parties to an IT contract providing for transatlantic data flows will have to prepare for any scenario and already anticipate its disappearance.
The position of the European Parliament on the EU-U.S. Privacy Shield
Drawing on the Commission’s findings of October 2017, the European Parliament filed a motion for a resolution in which it noted that the recommendations made at that time had not been followed up by the U.S. administration.
The Commission indeed wanted the system to be improved and recommended in particular to appoint a Privacy Shield Ombudsperson who would act as general supervisor and mediator in the implementation of the obligations under the Privacy Shield, and to promote closer cooperation between administrative and judicial authorities on both sides of the Atlantic.
The EU-U.S. Privacy Shield thus passed the Commission’s test, but the U.S. administration only response to those requests for improvement was to:
- adopt the CLOUD Act to facilitate access to personal data of “American persons” even if the data is physically hosted in Europe (4);
- facilitate communications surveillance by reactivating Section 702 of the Foreign Intelligence Surveillance Act (FISA);
- issue executive orders pursuant to this Act strengthening the establishment of generalized surveillance (Executive Orders 12333 and 13768).
Expressing its concerns, the Parliament invited the Commission to suspend the application of the Privacy Shield with effect from 1 September 2018, absent immediate reaction from the American authorities. This suspension eventually did not occur because the Parliament’s resolution has no binding force. The Commission later reacted through Commissioner Věra Jourová.
The position of the Commissioner in charge of the EU-U.S. Privacy Shield
The Commissioner in charge of digital technology heard the Parliament’s message and said that the appointment of the Ombudsman was a conditio sine qua non for maintaining the EU-U.S. Privacy Shield.
But the Commissioner did not endorse the other requirements laid down in Parliament’s resolution, as it was observed that, however imperfect its implementation may be, the rights of European citizens would be even weaker without the Privacy Shield than with it.
The Ombudsman would play a pivotal role as the European user’s contact point: he or she will be in charge of dealing with complaints concerning the application of Privacy Shield. A solution from the U.S. administration is expected by 18 October 2018, date on which the European Commission will submit its annual evaluation report, according to statements made in the Financial Times. Otherwise, a suspension of the Privacy Shield is possible.
Amid the Privacy Shield crisis, the Commission also intends to focus on another area: combating the misuse of the purpose of personal data processing, in particular for political purposes. The Commission sets sights on data breaches, in the wake of the famous Facebook-Cambridge Analytica data scandal. In these cases, the maximum fine provided for in the GDPR at 4% of the world’s annual turnover would be increased to 5%.
Possible actions in case of disappearance of the EU-U.S. Privacy Shield
The disappearance of the Safe Harbor by judgment of the Court of Justice of the European Union at the end of 2015 left its mark (5). Now, the parties to an IT contract covered by the Privacy Shield should be extra cautious, even if the EU-U.S. Privacy Shield still applies: an increasingly common practice is to take the precaution of mentioning in the contract that the parties undertake in advance to comply with any future agreement that may replace the Privacy Shield.
In case the Privacy Shield is not immediately replaced by another text, the parties may turn to other solutions such as:
- Binding Corporates Rules (BCR) for intra-group contracts,
- the standard contractual clauses proposed by the European Commission, or
- one of the derogations to the prohibition of transborder flows listed in Article 69 of the French Data Protection Act, if the circumstances of the transfers permit it.
Transatlantic data transfers are essential for the economic activity of many businesses; they are therefore strongly advised to be careful, prepare for any situation, and adopt a ‘better safe than sorry’ approach.
References:
- Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield.
- Report on the Privacy Shield Annual Review October 2017.
- European Parliament's Motion for a Resolution June 2018.
- Interview of Commissioner Věra Jourová, June 2018.
- Etat des lieux sur l’invalidation du Safe Harbor par la CJUE, article dated 30 October 2015.
Article provided by: Eric Le Quellenec (Lexing Law)
Discover more about the Cloud Privacy Check(CPC) / Data Privacy Compliance(DPC) project
Director CPC project: Dr. Tobias Höllwarth, tobias.hoellwarth@eurocloud.org